在东方热线论坛（东论）发帖、回帖、浏览热帖、查看帖子和回复。支持从环境变量或配置文件读取 token，无需登录。

This skill appears to implement the forum posting/browsing functionality it advertises, but note these points before installing: - Token handling: The script requires a forum token (CNOOL_API_TOKEN) though the registry metadata didn't declare any required env vars. The token will be sent to API endpoints at dzapi.cnool.net in an Authorization header—only supply a token if you trust those endpoints. - Local file I/O: The script can save the token to config.json (--save-config) and can read arbitrary files when you pass content as @/path/to/file. Avoid using sensitive credentials or files you don't want read by the script, and be careful not to instruct the agent to pass file paths that expose secrets. - Source provenance: There is no homepage or known source repository. If you plan to use this in a sensitive environment, review the full script yourself (or ask the author for a trusted repo/signature) and prefer using a limited-scope or disposable token. - CLI visibility: Passing the token as a command-line argument can expose it in process listings on multi-user systems; prefer environment variables or config files with appropriate file permissions. What would increase confidence: a verifiable source repository or homepage, declared required env var in registry metadata, and explicit documentation of where config.json is written at runtime. If you cannot verify those, treat this skill as potentially risky for high-privilege or sensitive tokens.

Type: OpenClaw Skill Name: donglun-cli Version: 1.0.0 The skill provides a legitimate CLI interface for interacting with the Donglun forum (bbs.cnool.net) via its official API (dzapi.cnool.net). The Python script (scripts/post_donglun.py) implements standard forum features such as viewing hot posts, reading threads, and posting/replying using a Bearer token. No evidence of data exfiltration, malicious execution, or prompt injection was found; the file-reading capability (@filename) is a standard feature for posting long-form content.